SECUFOCUSNOW
Home›CVE index›CVE-2025-40053
Review reviewHigh

CVE-2025-40053

Linux

In the Linux kernel, the following vulnerability has been resolved: net: dlink: handle copy_thresh allocation failure The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer dereference. This patch tries to allocate `skb`. If the allocation fails, it falls back to the normal path. Tested-on: D-Link DGE-550T Rev-A3

CVSS
7.5
EPSS
0.59%
44.7% percentile
CISA KEV
Not listed
Published
2025.10.28
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.59%
Technical severityCVSS 7.5

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: dlink: handle copy_thresh allocation failure The driver did not handle failure of `netdev_alloc_skb_ip_align()`. If the allocation failed, dereferencing `skb->protocol` could lead to a NULL pointer dereference. This patch tries to allocate `skb`. If the allocation fails, it falls back to the normal path. Tested-on: D-Link DGE-550T Rev-A3

Affected product and versions

Product
Linux
Affected versions
>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 84fd710a704f3d53d4120e452e86cea558cf73a8, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5aa9b885602811a026a3f45c92ea2b4b04c54f09, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 9d49e4b14609e1a20d931e718962c4b6b5485174, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ea87151df398d407a632c7bf63013290f01c5009, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7ed5010fef0930f4322d620052edc854ef3ec41f, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < fd7b6b2c920d7fd370a612be416a904d6e1ebe55, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8169a6011c5fecc6cb1c3654c541c567d3318de8, >= 2.6.12
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE
Not available